LayerZero Flags Lazarus Group Behind $292M KelpDAO Cross-Chain Hack

TLDR

• LayerZero links Lazarus to $292M KelpDAO rsETH cross-chain exploit
• KelpDAO loses $292M as attackers exploit LayerZero DVN setup flaw
• Lazarus Group blamed for rsETH drain via LayerZero verifier attack
• LayerZero flags DVN misconfig as cause of $292M KelpDAO breach
• Cross-chain flaw drains rsETH as LayerZero blames Lazarus Group

LayerZero identified a major exploit that hit KelpDAO and drained about $292 million in rsETH tokens. LayerZero traced the incident to North Korea-linked Lazarus Group activity. LayerZero confirmed the breach affected only rsETH without spreading across other connected applications.

Attack Method Targets LayerZero Messaging Infrastructure

LayerZero reported that attackers exploited cross-chain messaging validation tied to its Decentralized Verifier Network. LayerZero found that compromised RPC nodes enabled spoofed transaction approvals. Attackers drained 116,500 rsETH, representing nearly eighteen percent of total supply.

LayerZero stated that attackers replaced binaries on two RPC nodes within the verifier network. Besides, they launched denial-of-service attacks against remaining nodes to force system reliance on compromised endpoints.Malicious nodes delivered falsified transaction data while masking abnormal behavior from monitoring systems.

LayerZero explained that the attackers configured nodes to appear normal to external observers.The infrastructure self-destructed after completing the exploit, removing evidence from affected systems. As a result, forensic analysis was limited by deleted logs and configurations.

Configuration Weakness Exposed in KelpDAO Setup

LayerZero emphasized that KelpDAO used a single verifier configuration despite prior recommendations for redundancy. LayerZero had advised adopting multiple verifier networks to reduce single-point failure risks. The lack of diversification allowed attackers to manipulate the pathways used to validate transactions.

KelpDAO paused rsETH contracts across mainnet and several layer two networks after the breach. LayerZero restored its verifier network and initiated migration processes for vulnerable applications. LayerZero now refuses to process transactions from systems using single verifier setups.

KelpDAO continues working with auditors to identify root causes and secure remaining infrastructure. LayerZero coordinates with global authorities and blockchain investigators to track stolen assets. The incident ranks as the largest decentralized finance exploit recorded in 2026.

Contagion Effects Remain Limited Across DeFi Systems

LayerZero confirmed that the exploit did not impact other assets operating through its protocol infrastructure. LayerZero replaced affected RPC nodes and restored full network operations after containment. Multi-verifier applications resumed activity without further disruptions.

The incident triggered indirect pressure across decentralized finance platforms interacting with rsETH liquidity pools. Besides, protocols adjusted risk parameters to prevent further exposure to affected collateral. Some lending markets experienced temporary reductions in total locked value.

KelpDAO maintains communication with ecosystem partners to stabilize affected integrations. LayerZero continues enforcing stricter verifier standards across its network participants. The event highlights infrastructure risks within cross-chain validation systems despite protocol-level resilience.

The post LayerZero Flags Lazarus Group Behind $292M KelpDAO Cross-Chain Hack  appeared first on CoinCentral.